Managing a Global Portfolio: KYC, AML, and When to Consider a New Outsourcing Provider

Annie: Hello, everyone, and welcome to today's webinar, "Managing a Global Portfolio: KYC, AML, and When to Consider a New Outsourcing Provider." My name is Annie Triboletti. I'll be your moderator kicking things off today.

So joining us today are some of CSC's experts. From our Global Subsidiary Management side, we have Rogier Bronk. And from the world of KYC, we have Mike Jones, Akshay Bokadia, and Caiomhin Miller. So let's welcome Rogier, Mike, Akshay, and Caiomhin.

Rogier: Thank you, Annie. And before we get started, let's look at the agenda real quick. Now with introductions complete, thank you for that once again, Annie, we'll start with a brief overview of CSC before moving into a lively discussion on know your customer as well as anti-money laundering challenges. We will also explore CSC global service delivery model and robust KYC overview and walk through a case study before closing with some practical considerations and key takeaways.

CSC has been around for 125 plus years. We're still privately owned, since the third generation at the helm. We provide business administration and compliance solutions, supporting clients across 140 plus jurisdictions. Combined presence in 5 continents, with expertise and capabilities, like I mentioned, in 140 plus jurisdictions. Our services basically from inception to dissolution, so formation, compliance, corporate transactions, fund administration, but also digital brand services protection. We are a trusted firm for 90% of the Fortune 500 and more than 70% of the private equity firms. With more than 125 years of ownership, we bring continuity, experience, and a strong commitment to client service.

So without further ado, we have some really good subject matter experts on the KYC/AML front that I would like to somewhat reintroduce. Mike, our marketing team often receives a question, "How long does onboarding and implementation of services take?" I thought I would dive right in because that's often the question we receive the most, right? "How quick can you go?" They're excited to get on board with CSC. And the question is, "Can we start next month?" So can you lift the veil a little bit what makes onboarding, especially for KYC and AML so complex?

Mike: I can try here, Rogier, and I know it's the million-dollar question. I would love to come and tell clients it takes this amount of days and this amount of hours in every case. But every case is different, right? And maybe I come on to some of the challenges and the reasons why it may take an amount of time and some of the complexities that will cause that.

But you touched on readiness, client readiness in there. It's a real key one for us because a client may not be 100% ready to explore a new provider, and we're fine with that. Their business is moving, maybe directors are changing. There are formations ongoing. We understand that it's not a static business. But what I'd be an advocate of is engage us, Rogier, and let's speak about what you're doing over the coming period before you look at a new provider. What are the milestones and time scales that we could agree, as a partnership, to make it work?

So there isn't a one-size-fits-all answer for how long will it take. But we could get into a dialogue where we agree this is right for the client. We can work with internal stakeholders to make sure we get things ready within the time scales they're looking at. And it's a real important one in terms of readiness because it doesn't have to be 100%, but it's really good for us to know upfront where it isn't 100% so that we can help them on that journey, Rogier.

Rogier: Yeah. Yeah, we always say, when we are consulting the client on the services and framework that they would like to establish with CSC, that readiness and preparedness is key in moving things forward. But why can AML and KYC onboarding become more challenging when there are multiple jurisdictions involved, right? Not every jurisdiction is the same. But there are some of the items that trigger.

I'm not sure, Akshay. Is it a good question for you to answer because we've worked together prior to the acquisition of Intertrust by CSC? But we did things a little bit different in the past. How is that today?

Akshay: So as you as you mentioned, Rogier, so earlier there were a lot of challenges earlier, right, because we were more of a solo office rather than a centralized office. So what do I mean by that is we were working in pockets. So even though we have offices in more than 40 countries and we operate across 5 continents, but it was more towards being a solo player.

Now with GSM as a model or as a product which we offer to the client, you get a centralized team, who takes care of the entire portfolio. Imagine a client group which has to speak to 40 different colleagues across 40 countries, rather than 1 colleague speaking to the entire portfolio. It provides a lot of comfort, and it gives the client a more interactive way. It helps them to fix things faster and quicker as well.

And then with the setup of having colleagues across various jurisdictions, so even in AML and KYC teams, we have three hubs, which we call them as Americas, EMEA, and then APAC hub. So we have colleagues across the globe, which we are very proud, and we always call them as follow-the-sun model. Basically, we are everywhere to support you and also help you navigate the onboarding bit.

Rogier: Yeah. Yeah, it's similar to what we mention in our initial consultative approach to set up the services. We've always boast about having a very robust onboarding and implementation process in place. One of the challenges that most of our clients bump into is also the lack of tracking, right, not knowing. And especially when it's across multiple jurisdictions, how do we deal with that internally? Just to try to give the attendees to this webinar a little bit of comfort. Is there visibility? How do we connect the dots? How does that work?

Akshay: So we have seen clients, right, one being a centralized approach and another being a decentralized approach. We have seen clients who have various team members. So they can be same like us. They can have local teams managing local information. Now in order to have it centralized is another issue, right? We can help that with a nice platform. But that also creates an issue in terms of how do we get the data as well.

So one simple solution, which we always suggest to the client if you have a local or a global entity management solution, give us access to it so that way we reduce the amount of work which needs to be done. Of course, it can be read only for a limited time. We are not trying to get into the weeds of everything. It's just that whatever documents we need in terms of AML/KYC, we get those, and then the access can be restricted. That's one.

And the other is with the technology evolving and ever-evolving technology, we also try to do homework of the client groups by going through the public sources and various systems. If we can pull public information, like corporate extracts, articles, and governing documents, and that way reducing the number of documents what you need from the client. There are certain documents which the client can only give us because those are not publicly available or due to local regulatory requirement as well. But if there is a global entity management tool which the team already uses, they can provide us access to it, along with the public information, that would really help the team to prepare and fast track the onboarding.

Rogier: Yeah. So from what I'm hearing, speaking between Mike and you, Akshay, it's more a question for Caiomhin. When we are talking about the onboarding in general, whether it's KYC/AML or later on the corporate health check, it's truly a dual lift, right? We provide the framework, the single point of contact for these types of onboarding principles in place. But it's also more required on the client side, the preparedness and the readiness, what Mike mentioned in the beginning, to have a successful onboarding.

Now, Caiomhin, we always mention that we have a tailored onboarding approach that considers the exact needs of our clients. We go by a compliance calendar. But obviously, clients have sometimes urgent needs for specific jurisdictions. How do we map those requirements, and how do we discuss that on a regular or frequent basis with our clients?

Caiomhin: Thanks a lot, Rogier. I think, as you mentioned, like with GSM across the board, there are robust local processes there. So oftentimes when you have very competent people doing good work, with a good process, the best thing to do is just not get in the way. But in this business, as in all walks of life, challenges do arise, and that's where I think the real value of a global team like ours comes into focus.

Basically, you might have an issue arise in the form of documents not being available, immovable deadlines, requests to adopt a non-standard approach, or waive certain requirements. So we can act as that filter or point of escalation when these issues do arise. Take a holistic view of the whole business, the potential risks of not getting what is required, escalate those to the right decision-makers at the local level, and then hopefully get friction-free solutions for our clients, serve their needs while protecting our business. So that's kind of where I see the value of being able to take this holistic global view across relationships.

Rogier: Yeah. Yeah. And often we also get some feedback from clients who are in this process, that say like, "Well, they're asking everything, and we've already provided quite a bit of information upfront." But with what Mike said at the beginning, actually I confirmed it as well, is that when you have onboarding of multiple jurisdictions, sometimes additional documents trigger something very specific locally. How is that communicated, and how does it fit within in the implementation plan?

Caiomhin: Well, I think as the guys have mentioned there, information is always key. So the more we have upfront, the better are we able to predict any issues that may arise. Sometimes all the information isn't available. That's perfectly understandable. So when you get a situation as you describe, certain documents may have been provided, and they reveal a further requirement because of the specific local issue or regulation. What we would do there, and I think it's very important, is to communicate upfront what's happened, why, what the underpinning for the request is.

We'd also look to, in all cases, possible review and use the tools at our disposal to try and close that gap without going to the client. So that would be an important part as well. Say, "We've reviewed everything public. We can't bridge this gap. Here is why it is." And basically use that clear and effective communication to the client to explain to them what the need is, how we've tried to close it, and how it will serve their needs to provide what we have requested.

Rogier: Yeah. Thank you, Caiomhin. Basically what this slide sums up and the feedback that I hear from you guys, starting with Mike again, it's the readiness of the client. Often the decisions joining CSC on a global level are made on like at an executive level and stakeholder level, and then we have our folks that are on the client side that really are in the trenches and are working on getting the onboarding completed. So readiness, implementation plan, and communication is key. I don't want to say we do the rest, but having a centralized team in place that reviews your records, and, of course, behind the scenes technology does play a role as well, but I don't want to get too much into that because we have a KYC/AML webinar this time.

Now Caiomhin already highlighted in the previous slide that challenges may arise, depending on the information that we receive. So the more information we have upfront the better.

Now, how do we adapt to the process of our clients organizations? A lot of clients are still in a change management process. They're going from local providers, whether it's law firms or small providers in-country to a centralized platform. So, Mike, maybe this question would be good for you because you're currently traveling. You're based in Jersey, but traveling for a client to India. I personally think that shows some serious commitment right there. Can you provide some background on this and your day-to-day interactions with clients?

Mike: Yeah, absolutely, Rogier. And it's good to be here, and it's good to be asked. As you say, we're in India supporting a client. My role is fairly new to the organization, about a year in, obviously client relations and service delivery. This is a bit different. CSC works with being the business behind business. It's nice for us to be a department behind that business, that adds value to the client journey certainly from a KYC/AML perspective and making it more seamless for the client.

This one is a bit off piece in terms of our usual BAU day jobs, but we will speak to clients. Caiomhin alluded to escalations that may come to us as a specialist team from the wider KYC team. Escalations aren't just complaints, Rogier. In the main, it's an angle to help a client, whereby it may not be the 100% documentation we need, but could we look at a risk-based approach within the regulations that we need to adhere to protect CSC. And they're the kind of questions that we will deal with on a day-to-day basis. On a practical terms, Caiomhin, Akshay, and I will share messages throughout the day, on certain jurisdictions and certain clients, and sort of discuss how we can try and help get some of these over the line.

So it's been a good start. It took a year to speaking to our clients. We're looking after a lot of our key ones. But certainly where we're required right across the GSM business, we're helping out, trying to make business happen for our clients.

Rogier: Yeah. Well, thank you, Mike. And actually, that's a very good point that you're making there because I'm thinking about it. It's more question for Akshay because we've worked in the previous situation, that we were still Intertrust before it got acquired by CSC. You know, 140 plus jurisdictions, those are not all our wholly owned offices. We also work with best-in-class local partners.

Now under the GSM contractual framework, everybody adheres to the same terms and conditions internally. How does it affect, during the onboarding, the KYC collection? Are there differences between working with a wholly owned office versus a partner office or jurisdictional wise? Those are often questions that we also receive from our clients when they are almost ready to engage with us and say like, "Well, shall we start with the partner offices first, or with the local offices or regional?" How does this all affect KYC collection, Akshay?

Akshay: Yeah. So in terms of the onboardings, right, as you mentioned, so whenever you have a local office onboarding, we operate under a global operating model. Wherever there's a third party or a vendor jurisdiction, we have a strict policy with the vendors. We go through a scrutiny with them as well to ensure our standards and our policies and procedures, our privacy concept, security, everything is met. But ultimately, it applies to the CSC applicable review and the local jurisdictional model.

In either models, right, even if it's a local office or a vendor jurisdiction, the AML collection is really dependent upon the jurisdiction, the risk, the industry of the client, and the services which they request in those jurisdictions. So in certain jurisdictions, the services might be limited. But in certain jurisdictions, the services can be slightly higher. Even if we are operating with a local office here. there can be jurisdictions where if the services are less, what do I mean by services, if it's a regulated service or a non-regulated service, so based on the service, based on the industry of the client, based on the various other risk parameters, the AML/KYC is more or less aligned because it ultimately goes through a single global framework, and it has to comply with the local regulations rather than a global framework. So it's not a CSC framework. It is more of a jurisdictional framework, the local regulatory requirement, either way as well.

Rogier: Yeah. I think the last part is good to pick up on because in the initial stages of the conversations we have with our clients and we go through onboarding and implementation of services, we often hear, "You're asking a lot." It's not CSC that's asking this. It's the local requirements that prompt us to ask this type of information. And often we try to avoid duplication because we connect the dots behind the screen.

But Caiomhin, maybe a good question for you. Let's dive a little bit deeper, right? This is only the tip of the iceberg because document and information requires vary by jurisdiction. As Akshay mentioned, the entity type, regulated activity, the services, and scope that we are going to provide, but also the risk profile that we will be accepting within CSC. Now do documents and requirements apply in each country? And do they differ from case to case? And I'm looking more at like is it health care or manufacturing, or is it finance or, for example, hospitality? How does that work? Maybe a little bit too detailed of a question, but there are attendees on this webinar that are from different sectors and backgrounds. So highlighting any of what you know or can share would be appreciated.

Caiomhin: Thanks for that, Rogier, and definitely an interesting and relevant question. And as you rightly noted, there are a huge number of variables in play, be that across jurisdiction, entity type, regulated status, or the risk of the industry they may be in.

So I think, first of all, that's why it can be so valuable to have a partner like CSC, with the global reach and the deep local knowledge, to help guide you through that complexity. I think an interesting and instructive way to look at it is first of all to strip away all of the complexity and say what all of these things are designed to do is for us to be able to understand and document who and what the company is, what the industry and the risk of that industry they operate in is, and the risks associated with the people connected to that company and where their ownership extends to.

So again, it returns to what we mentioned earlier, around information, the value of it. When we have that information, we can parse it, go out look at the jurisdictions the client wants to go into, come back with basically a clear and concise list of what is needed, where it's needed, and why.

I think then to touch on your point around differing requirements at a local level, that's definitely true. Some jurisdictions can look on one industry as being of a higher risk than it might may be looked at elsewhere. That can automatically trigger a higher due diligence requirement. I think that, again, refers back to what we mentioned in the previous point. When that is the case and we have that information, we go back to the client. We give them that information in a very clear way. This is what we need that is additional. This is why it's needed in X jurisdiction because of how they view the industry you operate in or the complexity of the ownership structure they may have there.

So again, it's about getting the information, having the expertise to parse it, going out into those local jurisdictions, applying that information, seeing what the result is in terms of the due diligence, and then cleanly communicating that back to the client, again in a way that's hopefully kind of friction-free and comprehensive.

Rogier: Yeah, friction free, I like that one for sure.

Caiomhin: Yeah. Yeah.

Rogier: Okay, thank you, Caiomhin. And I think looking on this like global service delivery, I'd like to stay with you, Caiomhin, because one of the things that we earlier discussed internally was that everybody knows at some point, if we do our best in market, why the clients choose CSC. We're not getting into that. But you made a very good point because actually I mentioned this too, it's not CSC asking these types of documents and information. It's what's hovering above us, so to say, in the oversight that we have.

So one of the things you mentioned particularly is that why would it make CSC such a strong choice for global KYC and AML report. I think that's where we can set ourselves apart because every provider needs to go through this. So why do we have that covered better than our competitors in the market really?

Caiomhin: I think there's probably a few different things at play, and we talk about fierce client spirit a lot in this company. I know in a lot of places these can be taglines, but here I feel it rings true. I look at the team I work in, the wider teams we interact with. I see people, again, with that deep local knowledge willing to engage with these changing and increasingly complex regulatory environments. Strong leadership and relationship management teams working across borders and time zones to serve client needs. So I think basically it's a mix of all that technical and operational know-how, driven by that fierce client spirit that makes CSC a compelling choice in this sphere.

Rogier: Yeah. Yeah, indeed. That's something that echoes also within our market team, when we consult our clients on the best framework in place. But I think it's good to understand for the attendees that the robustness of our framework not only covers the service delivery, but most definitely the onboarding KYC/AML process as well.

So that being said, and that's more for Mike, because you, as head of client relationships and service delivery and KYC at CSC, how do we really connect the dots internally, and I mean global versus local, wholly owned office versus partner office, to ensure that we have a robust but yet client-friendly KYC and AML journey?

Mike: Yes, it's a good question, and it's a good objective of mine. Rogier and Akshay alluded to, the transition from Intertrust to CSC and becoming truly global. Where we would like to get to and we're developing and evolving all the time with our KYC processes, get a blueprint that applies globally, that is understandable for clients, that is the same questions and pathway in one jurisdiction as they dealt with us in another. There are some nuances out there, I agree with Rogier, in certain jurisdictions where it isn't a one-size-fits-all.

If we could get to a very high percentage of harmonization across our KYC and AML framework, maintaining our regulatory responsibilities, but also providing a clear story to our clients around what the process and journey will be from a KYC/AML process, that's our goal, and it's underway already, Rogier, We really want to get to be seamless and as perfect as we can be on that process.

Rogier: Yeah. And it's what Caiomhin initially mentioned, too, on this slide, right? It's like it's obvious why people should choose CSC from a service perspective. We're the only true global provider that can provide services in over 140 jurisdictions plus the U.S. domestic site, with integrated technology supporting us internally, but also on our client side. It's just as important because that's the change management part. It's the onboarding and implementation of services.

You don't want to get stuck here. I come back to the fact because I'm using the same phrase, Mike, we don't have a crystal ball. But it comes down to readiness, the availability of documentation, but knowing that it's like we're the business behind the business. It's the most important part.

So I think highlighting on this particular slide, and, Akshay, if you want to highlight anything of this global service delivery slide that we have currently on the screen. Is there anything else that jumps out to you, that we haven't discussed so far?

Akshay: No. So as I mentioned earlier, just being proactive KYC management is the highlight for me because we try to do homework before we even get into a client call. That's very important, and I value that a little more because unless you know the client and the client needs, how are we going to service them? And our CSC underlying tag, right, is we are the business behind business. So we are here with you to support you and navigate you. And as you mentioned, not everything can be in readiness. It's just that communication bit that this is what we have, this is what we don't have. How can we work through this? Those are the nuances that would really help that coming back to the point of collaborative support. So that way we work together to make it smoother for everybody, and that way we have a specialist team who can help us navigate through, across the globe.

Rogier: Yeah. You mentioned something that I want to dive a little bit deeper into, Akshay, if you don't mind, what we don't have.

Akshay: Yeah.

Rogier: Like I said, sometimes stakeholders are all aligned. Agreements have been signed. Everybody is very happy, and then a huge list of requirements, that are not coming from CSC, are I don't want to say being dumped on the client. This is all done in in bite-size elements to the client, based on communication that we have with them. But what if we or the client cannot produce certain documents, or simply is resisting to forward these documents to us? How do we go about that?

Akshay: So we have given them a lot of options in the past as well, Rogier. This is not uncommon across not only in CSC. That's across the industry as well, right? So there can be clients who have recently acquired groups where they might not have KYC or any documents per se. So we have also made sure that if we can go to the existing service provider, communicate it accordingly, and also look for documents or information which can be publicly available. What do I mean by that is go to registries, do the health check. One of the products, which we have referred to earlier, was the Corporate Health Check to see where is the framework, is the entity in good legal standing, yes or no, who are the directors registered, who are not, etc., etc.

So that way it really helps to get that ball rolling. And also the client understands that we understand their pain because I always feel that we have to put ourselves in the client's shoes. I do understand when you see a 20-line item to see this many documents I need to share. But it's just making it easier and trying to give them quick wins, rather than this is the entire thing which we need. But also identifying those quick wins, where we can finish a few entities and jurisdictions faster. Also, abiding by the local regulations, right?

So it's also planning in that kind of I don't want to say AML/KYC is a project management, but that it's similar. It's more of communication. It's more of understanding what the needs are, why we need to do certain things, how it can be done. And we have had clients who have asked us regulatory requirements, and as I mentioned, we have always communicated to them this is not a CSC requirement. This is a genuine local regulatory requirement. And we have given them articles, references of those as well, which they understand afterwards that yes, this is what it is.

And I've always been a fan of asking must haves, rather than good to haves because good to haves are good to haves. Must to haves are the local jurisdictional requirement. And we get only must to haves, not good to haves.

Rogier: But I want to actually go to the next slide because I think the next slide, let me toggle to that one, it's kind of like the slide where we can discuss what the key takeaways are of this particular webinar. And let me kick it off by saying CSC is the business behind the business. We've got you. This webinar is designed to provide some comfort for those attendees that are in the process of communicating and redlining agreements with us, but also those that want to come on board in the future. We do have a robust service delivery model in place, not only on the service delivery side but also on the KYC/AML onboarding and implementation side, which as we've learned from our experts on this call is actually more crucial because it's the beginning of the engagement and we want to make sure that we have a good start.

Preparation is everything. I come back to your word that you mentioned in the beginning, readiness from the client. But what key KYC/AML considerations would you recommend at this point?

Mike: So look, I think a few are called out on this slide right here. The entity portfolio, we've touched on previous questions around what jurisdictions are in scope, ownership structure. Services required is a big one as well. We would underwrite and consider different services in different jurisdictions in different ways. And to the readiness point, it could be you're ready for certain services, but there maybe is some more work to do on others. So that would be one I would say is a consideration. And I keep going back to it, but is their internal team ready? Do you have the correct people in place for us to interact with to make it as seamless as possible for you? And additionally, is your existing provider aware of the timelines you're working to if you're looking at coming to us? That they feel like the key ones for the client as the initial interaction with us, Rogier.

Rogier: I think the one that you mentioned are your internal teams ready on the client side is a big one, especially in combination with perhaps an acquisition has been completed six, seven months ago. Are those new colleagues aware of what needs to be done? Is there a new way of working being communicated top down? Clients often come back to market and say like it takes too long. And then we start diving into it, and it often falls back on clients not being ready for that change, of not being communicated correctly. So you're spot on with that. That's also something that we hear in our market.

It is not easy. We always say it's the heavy lift. But Caiomhin, I hear Mike saying constantly readiness. What impact does that have on the overall process and potentially locally, especially locally, right? When we work with partners, how is that communicated, and how is that tied into the overall process of KYC and AML gathering?

Caiomhin: Thanks, Rogier. Yeah, I think like to echo what Mike had said in terms of preparedness and to touch back on an earlier answer where we mentioned that the provision of new information can change the risk and that's how it can change things at local level, if there's something we don't know upfront, be it the discovery of a politically exposed person or an involvement in a high-risk industry at a local level, that can change what's needed by the regulations in that jurisdiction. So as we've mentioned, what we're asking for is driven by what we need, which is driven by what the local regulator has specified.

So really, in that instance, it comes down to information. You can't manage risk without knowing what it is. So the more information you have, the better able you are to advise upfront in a kind of anticipatory way of what is or might be needed and help the client understand and manage the process on their side. So I think that's one of the key points probably.

I think secondary to that is the communication of it, is having those good relationships, developing and maintaining them, so that when you go out with an ask like this, the client is going to understand that it comes from a place of CSC need this. They've done their homework. They've drilled down. They've sourced what they can publicly. Therefore, to get our business where it needs to be, it's a legitimate ask.

And then I think probably the final point around that, that I would say, coordination from CSC to the client, coordination of their stakeholders if it's a global business. So the better we all are aligned, the more seamless and smoother the journey will be. So it's information, it's communication, and it's coordination.

Rogier: Yeah, definitely those three are the ones that we also mention. Yeah, that's a very important one.

Akshay, I'm looking at bullet point number five, the last three words. It's an interesting one to me that we've not often used within our market teams. But monitoring beyond onboarding. Obviously, we want to keep the entities in good legal standing. It's also something that CSC ensures while the clients are on our framework. But how can CSC support KYC/AML monitoring after onboarding?

Akshay: Yeah. So one of the difficult things are imagine a client, if there is a director change, right, one of the directors is changing, and you had him being a director in 40 countries or 40 entities. Instead of going to local offices in 40 different instances, we can get his or her KYC in one instance. That way, we can go and register them as directors and replace directors. It can be addition. It can be deletion. So that way we know what is happening, and that helps the entity in good legal standing in terms of file reviews and periodic reviews as well.

So when there is a trigger event, like a change of ownership, it can be a change of directors, it can be a change of activity, that way, if it is centralized and it really helps the client to have one centralized team. Rather than doing it 40 or 50 instances, we do it in one time. And when a portfolio of clients is assessed at a group level, rather than at an entity level when you're doing the file review or a periodic review, also considering if there are any local nuances to it. But then it is on a portfolio and on a global level is what is considered.